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1 Method, System and Program Product for 

2 Managing Network Performance 

3 Field of the Invention 

4 The present invention relates to management of network services and more 

5 particularly to a method, system and program product for managing network performance 

6 by supporting generation of reliable, anticipatory alerts of potential performance 

7 violations. 

8 Background of the Invention 

When any computer network is put into service, the network operator and the 

jfi network users have their own expectations as to the level of performance to be provided 

ff t by the network. Where the network operator and the network users work for the same 

H organization, the expectations may be formalized in written memoranda or may exist only 

13 in the minds of the network users and (hopefully) the network operator. 

jrt Where the network operator and the network users work for different 

O organizations, the expectations may be formalized in a service level agreement. A service 

16 level agreement or SLA is an agreement or contract between a service provider, the 

17 network operator, and a customer, the network user. Under a service level agreement, the 

18 customer pays a service fee in return for an assurance that it will receive network service 

19 that conforms to requirements defined by the service level agreement. If the service 

20 provider then fails to provide the agreed-to service, it ordinarily becomes subject to 

2.1 penalties under the agreement, such as being required to rebate at least some previously 

22 received service fees or being required to reduce fees due for future services. 
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; While an almost infinite variety of service level agreements, both technical and 

2 non-technical in nature, are possible, the present invention generally relates to the 

3 management of network performance where performance requirements have been 

4 defined, either informally or in formal service level agreements. 

5 Network performance requirements, whether formal or informal, should reflect 

6 the type of network service being provided and the customer's specific requirements when 

7 it uses that service. A customer with high reliability requirements may, for example, 

8 expect or even obligate the service provider to keep the network in operation for no less 

9 than a specified percentage of time. Similarly, a customer for whom network response 

10 time is critical may expect or obligate the service provider to maintain average network 

11 transit times on critical routes at or below a defined threshold. 

/jg To verify that transit time requirements are being met, the service provider can 

$t regularly have a source network station "ping" (query) a destination network station to 

m determine round trip transit time; that is, how long it takes for the query to reach the 

is destination and for an acknowledgment to be returned from the destination to the source. 

Iff The actual performance of the system is usually monitored by a network 

£t management application which generates a message or alert when a performance 

18 violation occurs. That alert is sent at least to the service provider to enable the service 

19 provider to take steps to restore conforming network operation. This approach, while 

20 common, has significant drawbacks for both the network user and the service provider. 

21 From the network user's perspective, the performance violation may have already caused 

22 disruptions of significant tasks or processes by the time the network user first learns of it. 

23 Even if the service provider responds promptly to a violation alert, the recovery time or 

24 time required to return to conforming network operation is necessarily prolonged since 

25 the service provider can't begin to fix a problem until the problem is known to exist. 

26 From the service provider's perspective, the service provider may already be subject to 
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1 penalties under an existing service level agreement by the time it first learns of the 

2 penalty-inducing violation. Even where no formal service level agreement exists, the 

3 service provider can expect to lose customer good will for having failed to live up to the 

4 customer ' s expectations . 

j Summary of the Invention 

6 The present invention may be implemented as a method, system or program 

7 product which supports the reliable prediction of network performance violations so that 

8 a service provider receives advance warning of an impending violation and can take steps 

9 to avoid the predicted violation. 

m The invention can be implemented as a computer-implemented method of 

li managing network performance where performance requirements have been established. 

i| The provided service is monitored on a recurring basis to obtain samples of actual values 

"H of a performance-defining metric. A trend in actual service is established based upon the 

U obtained samples. Once the trend is established, the time at which the provided service 

JS will cease to meet the established performance requirements if the trend continues can be 

J6 determined. 

77 Brief Description of the Drawings 

18 While the specification concludes with claims particularly pointing out and 

19 distinctly claiming that which is regarded as the present invention, details of a preferred 

20 embodiment of the invention may be more readily ascertained from the following detailed 

2 1 description when read in conjunction with the accompanying drawings wherein: 

22 Figure 1 is a schematic representation of a network environment in which the present 

23 invention may be implemented; 
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2 



Figure 2 is a block diagram of essential components of a network management station in 
which the invention may be performed; 



3 Figure 3 is a functional flow diagram depicting major operations which take place when 

4 the invention is used; 

5 Figure 4 is a plot of performance metrics over several sampling intervals; 

6 Figure 5, consisting of Figures 5a and 5b, taken together, is a flowchart of essential steps 

7 performed by a method implementing the present invention; 

4 Figure 6 is a plot of conditions under which a pending alert can be canceled for certain 

# successive network performance trends; 

JJ Figure 7 is a plot of conditions under which a pending alert can be canceled according to 

>f an alternate embodiment of the invention; and 

" If Figure 8 is a partial flow chart showing method steps that are performed in implementing 

ft the alternate embodiment of the invention. 

= 14 Detailed Description 

75 Referring to Figure 1, the present invention is used in the administration of 

16 computer networks, one example of which is a network 10. The network 1 0 is 

17 represented as including a wide area network 12 which connects local networks to 

18 remote networks (not shown). The interface between the local networks and the wide 

1 9 area network 1 2 is provided through a gateway device 1 4 having an attached network 

20 management workstation 1 6. The illustrated local networks include both a token ring 

2 1 local area network (LAN) 1 8 and an ethernet LAN 26. Token ring LAN is shown as 
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1 having network stations 20 and 22 and a bridge 24 to the gateway device 14. Ethernet 

2 LAN 26 is shown as including network stations 28 and 30 and a bridge 32 to the gateway 

3 device 14. 

4 The types of networks and network devices shown in the drawing are intended as 

5 examples of a suitable environment for the present invention. The invention can be used 

6 in virtually any multi-node network where a performance metric is measurable. The 

7 invention should in no way be considered to be limited to the illustrated environment. 

8 Specific embodiments of the invention will be described below, but it should be 

9 kept in mind that the present invention can be implemented in several different forms, 
M such as in special purpose hardware or in a combination of hardware and software. A 
; fl typical combination of hardware and software is a general-purpose computer system 

45 using a computer program that, once loaded and executed, causes the system to carry out 

ij| method steps which will be described below. The software may be pre-loaded into the 

>| general-purpose computer system or may be separately available as a computer program 

:Jj product which, when loaded into a computer system, causes the system to carry out the 

jj$ methods steps. 

The term "computer program" in the present context means any expression, in any 
7s language, code, or notation, of a set of instructions intended to cause a system having 

19 information processing capability to perform a particular function either directly or after 

20 conversion to another language and/or reproduction in a different material form. 

2 1 Figure 2 illustrates the major physical components of a general-purpose computer 

22 system capable, when programmed properly, of implementing the present invention. The 

23 computer system includes a central processing unit (CPU) subsystem 34 with a processor 

24 and supporting registers, caches and logic circuits. The computer system further includes 

25 random access memory 36, hard drive 38 and an optical drive 40, such as a CD/R, 
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1 CD/RW or DVD drive. Where the invention is implemented as a program product, it is 

2 typically made available to the network operator initially on removeable magnetic or 

3 optical media for installation onto hard drive 38. Once the initial installation is complete, 

4 the program can be transferred into random access memory 36 as needed from hard drive 

5 38. Alternatively, the program may be loaded into random access memory 36 directly 

6 from an optical media mounted in optical drive 40. The computer system further 

7 includes system input/output (I/O) adapters 42 supporting connections to standard system 

8 components such as a keyboard 44, a pointing device 46 and a display monitor 48. 

9 Finally, the computer system includes a network interface card 50 which provides the 
10 needed interface to the rest of the network. 

U Figure 3 is a functional flow diagram illustrating major functions that are 

# performed by a computer system programmed in accordance with the present invention. 

J3 Among other tasks, the computer system functions as a network performance monitor 52 

If by making and/or receiving measurements reflecting actual network performance over 

>f time. The performance measurements constitute samples which are processed by a 

46 service metric sample processor function 54 to convert those samples to a metric (such as 

H an average value) which reflects current network performance. For the sake of simplicity, 

S the following discussion assumes that a single type of metric (average ping time) is 

9 monitored. In some situations, it may be desirable to monitor more than one type metric 

20 so that appropriate actions can be taken where any one of the metrics exceeds an 

21 allowable value. 

22 Where successive values for a defined metric have been gathered, those values 

23 can be processed in a trend module generator to determine whether there is a recognizable 

24 trend in the metric values over time. Where a metric is trending toward an unacceptable 

25 value, an alert generator function 58 can generate and send an anticipatory alert to the 

26 service provider in advance of an actual violation. The anticipatory alert gives the service 
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provider time to take steps which will head off an actual violation of defined performance 
requirements. 



3 Figure 4 is plot of a specific service metric over several sampling intervals. The 

4 specific service metric is ping time on a particular route between a first network station 

5 and a second network station; i.e., the time required for the first station to send a ping or 

6 query to the second station and to receive a response from the second station. Typically, 

7 the first station, which may be a network management station, is required to perform a 

8 minimum number of ping tests over a standard sampling interval 60 which, for purposes 

9 of this description, is assumed to be a 24-hour day. The actual or raw samples gathered 
10 over the course of each sampling interval can be processed to obtain an average ping 
U value representing the average network performance over the entire day. Object 62 

■§ represents the average ping value over a first sampling interval 60. As a matter of 

!S convention, object 62 shown as occurring at the midpoint of the interval even though its 

5} value can't be determined until the interval has ended. To establish a trend in actual 

>| network performance, ping times are taken throughout the day and are averaged to 

46 establish the actual network performance for that day. Objects 64 and 66 represent the 

.if ping time averages for the second and third sampling intervals on the plot. 

Qfe A trend in actual network performance is established by using two or more of the 

Tp average ping time values and known linear regression techniques to derive a curve or line 

20 68 representing the trend. Depending upon the service metric chosen and the network 

27 performance requirements, the trend-indicating line can be a simple straight line 

22 established using two acceptable metric averages or a curved line fitted using several 

23 successive acceptable metric averages. Assuming a straight line 68 adequately describes 

24 the trend, the slope (positive or negative) of that line indicates whether the actual network 

25 performance over time is trending toward or away from a limit 70 of acceptable network 

26 performance (maximum allowable average ping time). 
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1 A simple approach to network management would be to wait for the average ping 

2 time to exceed limit 70 before generating any sort of alert to the system provider. The 

3 present invention uses a better approach. The slope of the trend-indicating line can be 

4 calculated using two acceptable ping time averages. Once the slope of the trend- 

5 indicating line and at least one average ping time value is known, straight-forward 

6 mathematic calculations can be used to predict the time t v at which the average ping time 

7 will exceed the limit 70 if the trend continues unchanged. 

8 In accordance with a preferred embodiment, an alert is not sent simply because a 

9 trend toward unacceptable ping times is established. For an alert to be of interest to a 

10 system provider, it must be reasonably imminent. A system provider is not likely to want 

U to respond to a prediction of unacceptable ping times far in the future given the possibility 

: § that the trend toward unacceptable ping times might level off or be reversed in the course 

p of normal system operation. For that reason, an alert is generated and sent to the system 

i J provider only where the predicted violation time /„ falls within a time window (for 

)$ example, two days) beginning at the current time. If t v is predicted as occurring outside 

■46 of the time window, no alert is generated. 

f/7 Even where an alert has been generated and sent to the service provider, the 

% possibility still exists that the trend toward increasing ping time averages will level off or 

79 reverse itself in the course of normal system operation. In accordance with one feature of 

20 the invention, network performance (represented by average ping time) continues to be 

2 1 monitored even after an alert is generated. If the trend resulting in a pending alert is 

22 found to have changed substantially, a pending alert may be canceled. 

2 3 For the described process to work reliably, the data used in the process must be 

24 reliable. In any process which relies on sampling of actual values, there is always the 

25 possibility that abnormal system conditions will result in abnormal sample values during 

26 any given sampling interval. To eliminate unreliable sets of samples, the present 
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invention imposes reliability tests for each set of samples used in establishing a 
performance trend. If the reliability tests, described below, are not satisfied for a 
particular set of samples, the set is ignored, at least for trend determination purposes. The 
set of samples may be retained in the system for other purposes beyond the scope of this 
invention. 

A first and seminal reliability test is that the number n of samples obtained over a 
sampling interval must exceed a predetermined minimum. Conventionally, it is assumed 
that at least thirty measurements or samples of a particular metric are needed to support 
reliable statistical analyses. If, during a particular sampling interval, less than thirty 
samples are obtained, no attempt is made to establish a performance trend using the 
sample set. 

Assuming the necessary minimum number of samples have been obtained over 
the sampling interval, a second reliability test uses standard statistical techniques to 
derive the statistical mean and the statistical standard deviation of the set of samples 
under consideration. For a set of n samples, each having an individual raw value y„ the 
statistical mean is simply the average of the values; that is 



y, 



n 



For the same set of samples, the standard deviation s can be computed as 



n 



Z (yd 2 -(I yd 2 



s = 



1 



n(n - 1) 
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1 To determine whether a particular set of samples, the mean value y mean and the 

2 standard deviation s of the set are used to generate a Confidence Percentage value CP 

3 where 

nr> _ ymean 

4 Cr — 

S 

5 A set of samples is considered reliable (and thus suitable for use in the described process) 

6 if CP does not exceed a predetermined percentage threshold, preferably on the order of 

7 25%. If CP exceeds the predetermined threshold, no effort is made to determine a 

8 performance trend based on the "unreliable" set of samples. 

9 Where a set of samples gathered during a particular sampling interval are not to be 
% used as failing to meet reliability tests, acceptable samples gathered during preceding and 
\fi following sampling intervals can still be used to establish the trend in network 

■■■4$ performance. 

1^3 Figure 5 is a flowchart of method steps that are performed in implementing the 

3^ present invention. The initial step 74 is to perform a system test which generates raw 
:?5 sample values. The ping response time test described above is just one example of many 

H 6 types of system tests which might be performed to obtain a measure of actual network 
W performance. Each test 74 is followed by a time check 76 which determines whether the 

18 current sampling interval has just ended or expired. If the sampling interval has not 

19 expired, a second time check 77 is made to determine whether a inter-sample interval 

20 timer has expired. 

21 The inter-sample interval timer is used to limit the number of samples acquired 

22 during a given sampling interval since every test operation performed to acquire a sample 

23 represents network overhead and necessarily impacts network throughput. As noted 

24 earlier, good statistical practice requires a minimum of thirty samples for statistically 
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/ reliable averaging. Therefore, it can be expected that the inter-sample interval timer will 

2 have a short enough timeout period to guarantee that at least thirty samples will be 

3 obtained over the course of the sampling interval. The maximum number of samples to 

4 be obtained may vary with the type of system test being performed. For ping time tests, 

5 it is believed that a maximum of 1 30 - 1 50 samples per twentyfour hour sampling interval 

6 is appropriate. 

7 When the sampling interval does expire, the number of samples obtained during 

8 the interval is compared to a minimum threshold number in operation 78. If the number 

9 of samples falls below the minimum threshold, no effort is made to continue the trend 
10 determination process and the current process cycle is ended. Even though the current 
U process cycle ends, a new sampling cycle is already underway for the new sampling 
# interval that has just begun. 

3§ Assuming an adequate number of samples is obtained for the current cycle, the 

~lk raw samples are summed in step 80. In a following step 82, each raw sample in the set is 

J5 squared and the squared values are summed. The average or mean value for the set is 

% obtained in step 84 while the standard deviation for the set is calculated in step 86. 

•;3 7 As described earlier, the set of samples may or may not be used depending the 

confidence percentage CP for the set; that is, the ratio of the set' s standard deviation to 

19 its mean or average value. The CP value is calculated in step 88 using the earlier- 

20 described equation and then compared to a predetermined threshold percentage in step 90 

2 1 to determine whether the set's CP value falls within acceptable limits. If the set's CP 

22 value falls outside the acceptable limits, the trend determination process is ended without 

23 using the "unreliable" set of samples 

24 Assuming the set of samples under consideration satisfies the defined reliability 

25 tests, the averages or mean values for the current set and an earlier set of samples are used 
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1 in an operation 94 to determine whether there is a trend in average ping response times. 

2 The trend is characterized by the slope of a line passing through the two time displaced 

3 mean values. The slope is tested in step 96 to determine whether the average ping 

4 response times are approaching a violation threshold. If step 96 shows that the trend is 

5 toward violation, the current slope of the line, one of the average ping response times at 

6 an endpoint of the line and the violation threshold are used to predict (step 98) when the 

7 average ping response time will exceed the threshold assuming the current trend 

8 continues unchanged. 

9 This predicted time-until-violation value can be determined by solving the 

10 equation 

11 y — wx + b for the value of x where 

:J2 y = the maximum acceptable (violation threshold) average ping time, 

|| m = the computed slope of the trend line during the last sampling interval, 

]3 b = the current average ping time, and 

%| x = the time-until-violation as measured from the current time. 

Te The variables y, m and b are known, making it a simple matter to determine x. Once the 

'tf predicted violation time is established, it can be checked in an operation 1 00 against the 

Iff? limits of a time window (for example, a time window that begins at the current time and 

Iff ends 48 hours later). If the predicted time of violation Mis outside the time window, the 

7& current process cycle is ended with no action being taken other than to preserve the 

21 values calculated using the current set of samples. However, if the predicted time of 

22 violation falls within the time window, an alert is generated in step 1 02 and sent to the 

23 network manager. 

24 If step 96 does not indicate that the current trend is toward the violation threshold, 

25 meaning the trend is either flat or away from the violation threshold, then a check 103 is 

26 made as to whether a previously generated alert is still pending. If there is no pending 

27 alert, no further computations are performed and the current process cycle is ended. 
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1 If a previously generated alert is still pending, the absolute value of the slope of 

2 the current trend line is compared to the absolute value of the slope of the preceding trend 

3 line in an operation 104. Unless the absolute value of the new slope is greater than the 

4 absolute value of the preceding slope while the sign of the new slope is negative, the 

5 trend toward an eventual violation necessarily continues. The samples and the metric 

6 average are retained. The previously-generated alert is not affected. The current process 

7 cycle is ended to allow the next iteration of the process to continue. 

8 If, however, the absolute value of the new slope is greater than the absolute value 

9 of the old while their algebraic signs are different, a significant trend away from the 

10 violation threshold is necessarily indicated. . This can most clearly be seen by reference 

77 to Figure 6 where line 110 represents an old or prior trend line while line 1 12 represents 

/j the current trend line. While the slope of line 1 1 0 shows a trend toward violation, the 

H slope of line 112 shows an even sharper trend away from violation. Referring back to 

M Figure 5, where a significant trend away from violation is found from the test 104, the 
previously-generated and still pending alert is canceled in step 106. 

3 An alternative and less stringent test for determining when to cancel a previously 

generated alert is described below with reference to Figures 7 and 8. The alternative test 

jfcS is based on a premise that a pending alert issued as a result of a prior trend can safely be 

W canceled if an alert would not be generated based on the current trend. Recall that an alert 

20 is generated in the process described above where a trend toward a violation threshold 

21 will cross that threshold within a predetermined time window if the trend continues 

22 unchanged. A time window of two days was assumed for purposes of illustration. 

23 Referring first to Figure 7, which illustrates the premise of the alternative process, 

24 an alert is generated at time t3 because the trend characterized by line 114 would result in 

25 the violation threshold being exceeded within two days of time t3. However, for the 

26 current trend represented by line 1 1 8 (beginning at time t3 and ending at time t4), it can 
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1 be seen that the lesser slope of the current trend would not, if continued, cause the trend 

2 to reach the violation threshold will not be exceeded within two days of time t4 even if 

3 the trend continues unchanged. Under the noted conditions, no alert would be issued at 

4 time t4. If an alert would not be issued at time t4 based on the then current trend, it 

5 would be illogical to allow a previously-generated alert to remain in force. If a 

6 determination is made that current conditions do not warrant generation of an alert at 

7 current time t4, then pending alerts based on past conditions are canceled. 

8 Figure 8 is a flow chart of the method steps required to carry out the alternative 

9 process steps noted above. The method steps previously described with reference to 

10 Figure 5 remain unchanged from the beginning of that Figure through the output from 

11 operation 94, which is the slope of the current trend line. In the alternative process, the 
H determined slope is used as an input to a step 120 which determines whether the current 
^ trend is toward violation. If it isn't, any pending alerts are canceled. If the trend is found 
l M still to be toward violation, the time at which the trend will result in a violation is 

predicted in step 124. If the predicted time of violation falls is found to fall within the 

78 time window in step 126, then a new alert is generated in step 128. Previously-generated 

W alerts (if any) are not canceled. 

g If, however, the test 126 indicates that the latest predicted time of violation falls 

14 outside the time window, which means that no alert is to be generated based on current 

20 conditions, test 130 looks for previously-generated and still pending alerts. If any such 

21 alert or alerts exist, they are canceled in step 132. 
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7 While there has been described what is believed to be a preferred embodiment of 

2 the invention, variations and modifications in the preferred embodiment will occur to 

3 those skilled in the art. Therefore, it is intended that the appended claims shall be 

4 construed to include the preferred embodiment and all variations and modifications as fall 

5 within the true spirit and scope of the invention. 
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Claims 



What is claimed is: 

1 LA computer-implemented method of monitoring network performance where 

2 performance requirements are already established comprising the steps of: 

3 monitoring a performance-defining metric on a recurring basis to obtain 

4 samples of the metric value; 

5 determining a trend in actual service based on obtained samples of the 

6 metric; 

7 determining a performance violation time equal to the time at which the 

8 actual service will cease to meet the established performance requirements if the 
% determined trend continues. 

! i| 2. A computer-implemented method as set forth in claim 1 wherein the step of 

'4i determining a trend is performed using linear regression. 

-33 3. A computer implemented method as set forth in claim 2 wherein the step of 

; J determining a trend includes the further steps of: 

% analyzing a set of samples obtained over a predetermined sampling 

© interval to determine whether the analyzed set satisfies predetermined sample 

5 criteria; and 

6 terminating the step where the analyzed set fails to satisfy the 

7 predetermined sample criteria. 

8 4. A computer implemented method as set forth in claim 3 wherein the step of analyzing 

9 a set of samples comprises the step of determining whether the standard deviation of the 
w set is greater than a predetermined percentage of the mean of the sample. 
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7 5. A computer implemented method as set forth in claims 1 - 4 including the additional 

2 step of generating an alert if the performance violation time is predicted to fall within a 

3 fixed time window beginning at the current time. 

/ 6. A computer implemented method as set forth in claim 5 including the additional step 

2 of canceling a previously generated alert in the absence of a prediction that the 

3 performance violation time will fall within the fixed time window. 

1 7. For use in a system wherein at least one network performance metric is required to 

2 comply with predetermined requirements, a computer-implemented method for providing 

3 an alert, said method comprising the steps of: 

4 monitoring the provided service to obtain, on a recurring basis, sets of 
.JJ samples representing actual network performance; 

% using the obtained sets of samples to generate a mathematical 

representation of a current trend in the network performance metric; 

; 5 using the mathematical representation, predicting the time when the 

network performance metric will exceed a defined threshold if the current trend 

IB continues; and 

|i generating an alert if the predicted time is within a fixed time window 

|2. which begins upon execution of the method. 

1 8. A computer-implemented method as set forth in claim 7 including the additional step 

2 of transmitting the generated alert to a network operator. 

/ 9. A computer-implemented method as set forth in claim 8 wherein the mathematical 

2 representation is generated using linear regression techniques. 

! 1 0. A computer-implemented method as set forth in claims 7 - 9 wherein the step of 

2 using the obtained samples includes the additional steps of: 
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3 calculating predefined statistical parameters of each obtained set of 

4 samples; 

5 determining whether the calculated statistical parameters meet predefined 

6 threshold requirements; and 

7 terminating the process if where the calculated statistical parameters for an 

8 obtained set of samples fails to meet the predefined threshold requirements. 

/ 1 1 . A computer- implemented method as set forth in claim 1 0 wherein the calculated 

2 statistical parameters comprise the standard deviation and mean of the set of samples and 

3 the predefined threshold requirement requires that the standard deviation be no greater 

4 than a predetermined percentage of the mean, 

;j§ 12. A system for providing an alert indicating a predicted violation of a predetermined 

'2 network performance requirement, the system comprising: 

:= S a performance monitor which obtains sets of samples of a predefined 

'"--4 service metric on a recurring basis; 

a sample processor which receives the obtained sets of samples and 
x -4 generates a mathematical representation of a current trend in service metric 

W values; 

!^ logic elements which use the generated mathematical representation to 

^ predict when the service metric will cross a defined threshold if the trend 

10 represented by the mathematical model continues; and 

// an alert generator for generating an alert if the determined time is less than 

12 a predetermined time from the current time. 

1 13. A system as set forth in claim 12 further including transmitter logic for transmitting 

2 the generated alert to a network operator. 
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1 14. A system as set forth in claim 13 wherein the sample processor further contains logic 

2 for performing linear regression operations using the obtained sets of samples of the 

3 predefined service metric. 

1 15. A system as set forth in claim 14 wherein the sample processor further includes: 

2 statistical logic for determining the standard deviation and the mean of 

3 each obtained set of samples; 

4 arithmetic logic for determining the ratio of the standard deviation and the 

5 mean of each obtained set of samples; and 

6 thresholding logic for terminating any prediction where an obtained set of 

7 samples is determined to have a ratio exceeding a predefined threshold. 

ij| 14. An article of manufacture comprising a computer useable medium having a computer 

^ readable program embodied in said medium, wherein the computer readable program 

y when executed in the computer causes the computer to: 

h 4 receive, on a recurring basis, sets of samples of a service metric obtained 

y by monitoring an actual network performance where the network is subject to at 

Q least one predetermined network performance requirement; 

k£ determine a trend in actual service based on received sets of samples; and 

f& predict when the service metric will exceed a defined threshold if the 

determined trend continues. 

1 15. An article of manufacture comprising a computer useable medium having a 

2 computer readable program embodied in said medium, wherein the computer readable 

3 program when executed in the computer causes the computer to: 

4 receive, on a recurring basis, sets of samples of a service metric obtained 

5 by monitoring the actual performance of a network; 

6 ignore any received set of samples which fails to satisfy predetermined 

7 sample criteria; 
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8 determine a trend in actual service metric values based on retained 

9 samples; and 

10 predict when the service metric will exceed a defined threshold if the 

1 1 determined trend continues. 

7 1 6. An article of manufacture comprising a computer useable medium having a computer 

2 readable program embodied in said medium, wherein the computer readable program 

3 when executed in the computer causes the computer to: 

4 receive, on a recurring basis, sets of samples of a service metric obtained 

5 by monitoring the performance of a network; 

6 use obtained sets of samples in generating a mathematical representation 

7 of a current trend in service metric values; 

: J use the mathematical representation to predict when the service metric 

will exceed a defined threshold if the current trend continues; and 

H generate an alert if the elapsed time is less than a predefined time. 

1 17. An article of manufacture comprising a computer useable medium having a computer 

l ~i readable program embodied in said medium, wherein the computer readable program 

H when executed in the computer causes the computer to: 

'f4 receive, on a recurring basis, sets of samples of a service metric obtained 
by monitoring the performance of a network; 

6 calculate predefined statistical parameters of sets of obtained samples; 

7 determine whether the calculated statistical parameters meet predefined 

8 threshold requirements; 

9 ignore any set of samples for which the predefined threshold requirement 

10 is not met; 

11 use retained sets of samples in generating a mathematical representation of 

12 a current trend in service metric values; 
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13 use the mathematical representation to predict when the service metric 

14 will exceed a defined threshold if the current trend continues; and 

15 generate an alert if the elapsed time is less than a predefined time. 
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1 Method, System and Program Product for 

2 Generating Service Level Agreement Alerts 

3 Abstract of the Disclosure 

4 A service level agreement between a network service provider and a network user 

5 may require that specified service metrics or parameters be maintained within 

6 predetermined limits. To reduce the chance those limits (and the service level agreement) 

7 will be violated, the service metric is sampled periodically over successive sampling 

8 intervals. The mean value and the standard deviation of the set of samples obtained 

ijf during the most recent sampling interval are used to screen out unreliable data. If the set 

'jp of samples satisfies the reliability screening, the set is used in combination with past 

>j acceptable sets to determine the trend in the sampled service metric. If the trend is 

%2 toward a violation, the time of the violation is predicted based on the assumption the 

B current trend will continue. If the predicted time of violation is sufficiently near the 

l M current time, an alert is sent to the service provider to permit the service provider to 

IW initiate anticipatory corrective action. 
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